2007-07-24 18:10:05 +00:00
|
|
|
#! /bin/sh /usr/share/dpatch/dpatch-run
|
|
|
|
|
## 00_named_refused.dpatch by Yaroslav Halchenko <debian@onerussian.com>
|
|
|
|
|
##
|
|
|
|
|
## All lines beginning with `## DP:' are a description of the patch.
|
|
|
|
|
## DP: No description.
|
|
|
|
|
|
|
|
|
|
@DPATCH@
|
|
|
|
|
diff -urNad trunk~/config/filter.d/named-refused.conf trunk/config/filter.d/named-refused.conf
|
|
|
|
|
--- trunk~/config/filter.d/named-refused.conf 1969-12-31 19:00:00.000000000 -0500
|
2007-07-30 02:31:35 +00:00
|
|
|
+++ trunk/config/filter.d/named-refused.conf 2007-07-29 22:31:22.000000000 -0400
|
|
|
|
|
@@ -0,0 +1,34 @@
|
2007-07-24 18:10:05 +00:00
|
|
|
+# Fail2Ban configuration file for named (bind9). Trying to generalize the
|
|
|
|
|
+# structure which is general to capture general patterns in log
|
|
|
|
|
+# lines to cover different configurations/distributions
|
|
|
|
|
+#
|
|
|
|
|
+# Author: Yaroslav Halchenko
|
|
|
|
|
+#
|
|
|
|
|
+# $Revision: $
|
|
|
|
|
+#
|
|
|
|
|
+
|
|
|
|
|
+[Definition]
|
|
|
|
|
+
|
|
|
|
|
+# if you want to catch only login erros from specific daemons, use smth like
|
|
|
|
|
+#_named_rcodes=(?:REFUSED|SERVFAIL)
|
|
|
|
|
+# To catch all REFUSED queries only
|
|
|
|
|
+_named_rcodes=REFUSED
|
|
|
|
|
+_daemon=named
|
|
|
|
|
+
|
|
|
|
|
+#
|
|
|
|
|
+# Shortcuts for easier comprehension of the failregex
|
|
|
|
|
+__pid_re=(?:\[\d+\])
|
|
|
|
|
+__daemon_re=\(?%(_daemon)s(?:\(\S+\))?\)?:?
|
|
|
|
|
+__daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
|
|
|
|
|
+# hostname daemon_id spaces
|
2007-07-30 02:31:35 +00:00
|
|
|
+# this can be optional (for instance if we match named native log files)
|
|
|
|
|
+__line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
|
2007-07-24 18:10:05 +00:00
|
|
|
+
|
|
|
|
|
+# Option: failregex
|
|
|
|
|
+# Notes.: regex to match the password failures messages in the logfile.
|
|
|
|
|
+# Values: TEXT
|
|
|
|
|
+#
|
|
|
|
|
+failregex = %(__line_prefix)sunexpected RCODE \(%(_named_rcodes)s\) resolving '.*': <HOST>#\S+$
|
2007-07-24 20:04:20 +00:00
|
|
|
+ %(__line_prefix)sclient <HOST>#\S+: query(?: \(cache\))? '.*' denied\s*$
|
2007-07-24 18:10:05 +00:00
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
diff -urNad trunk~/config/filter.d/named-refused.examples trunk/config/filter.d/named-refused.examples
|
|
|
|
|
--- trunk~/config/filter.d/named-refused.examples 1969-12-31 19:00:00.000000000 -0500
|
2007-07-30 02:31:35 +00:00
|
|
|
+++ trunk/config/filter.d/named-refused.examples 2007-07-29 22:30:29.000000000 -0400
|
2007-07-24 20:04:20 +00:00
|
|
|
@@ -0,0 +1,13 @@
|
2007-07-24 18:10:05 +00:00
|
|
|
+Jul 15 18:42:00 raid5 named[3888]: unexpected RCODE (SERVFAIL) resolving 'skira.de/NS/IN': 216.14.208.5#53
|
|
|
|
|
+Jul 15 18:42:01 raid5 named[3888]: unexpected RCODE (SERVFAIL) resolving 'skira.de/NS/IN': 216.14.208.4#53
|
|
|
|
|
+Jul 17 01:46:09 raid5 named[3866]: lame server resolving 'vallone.de' (in 'vallone.de'?): 62.156.146.242#53
|
|
|
|
|
+Jul 17 01:49:41 raid5 named[3866]: unexpected RCODE (REFUSED) resolving 'a-s-l.de/A/IN': 192.76.144.17#53
|
|
|
|
|
+Jul 17 01:49:41 raid5 named[3866]: unexpected RCODE (REFUSED) resolving 'a-s-l.de/A/IN': 194.128.171.100#53
|
|
|
|
|
+Jul 17 11:18:39 raid5 named[3866]: unexpected RCODE (REFUSED) resolving 'stadtkrankenhaus-ruesselsheim.de/A/IN': 192.76.144.15#53
|
|
|
|
|
+Jul 17 11:18:39 raid5 named[3866]: unexpected RCODE (REFUSED) resolving 'stadtkrankenhaus-ruesselsheim.de/A/IN': 194.128.171.101#53
|
|
|
|
|
+Jul 18 23:26:34 raid5 named[3891]: unexpected RCODE (REFUSED) resolving 'golgotha.de/A/IN': 217.195.32.108#53
|
2007-07-24 20:04:20 +00:00
|
|
|
+Jul 24 14:16:55 raid5 named[3935]: client 194.145.196.18#4795: query 'ricreig.com/NS/IN' denied
|
|
|
|
|
+Jul 24 14:16:56 raid5 named[3935]: client 62.123.164.113#32768: query 'ricreig.com/NS/IN' denied
|
|
|
|
|
+Jul 24 14:17:13 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'geo-mueller.de/NS/IN' denied
|
|
|
|
|
+Jul 24 14:20:25 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'shivaree.de/NS/IN' denied
|
|
|
|
|
+Jul 24 14:23:36 raid5 named[3935]: client 148.160.29.6#33081: query (cache) 'mietberatung.de/NS/IN' denied
|
